<?php

require_once __DIR__ . '/inc/webauthn.php';

require_once __DIR__ . '/inc/layout.php';

header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');

header('Pragma: no-cache');

header('Expires: 0');

// Logout runs before the cache-buster redirect so it takes effect on the

// first request rather than after a bounce, and so the stamped URL is never

// the one carrying ?logout=1. date('His') repeated within a second, so the

// destination is stamped with random bytes instead.

if (isset($_GET['logout'])) {

    log_out();

    header('Location: index.php?loggedout=' . bin2hex(random_bytes(4)));

    exit;

}

// Same stale-cache defense as the other pages; the login POST passes through.

cache_buster_redirect();

if (is_logged_in()) {

    header('Location: index.php');

    exit;

}

$firstRun = !password_is_set();

$error = '';

// Offer the passkey button only when there is one registered for this host

// that the browser could actually use — otherwise it can only fail.

$hasPasskeys = false;

if (!$firstRun && webauthn_available()) {

    $st = db()->prepare('SELECT COUNT(*) FROM passkeys WHERE rp_id = ?');

    $st->execute([webauthn_rp_id()]);

    $hasPasskeys = (int)$st->fetchColumn() > 0;

}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    check_csrf();

    $pass = (string)($_POST['password'] ?? '');

    if ($firstRun) {

        if (strlen($pass) < 8) {

            $error = 'Password must be at least 8 characters.';

        } elseif ($pass !== (string)($_POST['confirm'] ?? '')) {

            $error = 'Passwords do not match.';

        } else {

            save_password($pass);

            log_in();

            remember_login();

            flash('Password set. Welcome!');

            header('Location: index.php');

            exit;

        }

    } elseif (verify_password($pass)) {

        log_in();

        remember_login();

        header('Location: index.php');

        exit;

    } else {

        sleep(1);

        $error = 'Wrong password.';

    }

}

page_header($firstRun ? 'Set password' : 'Login');

?>

<h1><?= $firstRun ? 'Set a password' : 'Login' ?></h1>

<?php if ($firstRun): ?>

<p class="muted">First run: choose the admin password for this site. It will be required for adding, editing, and using filament.</p>

<?php endif; ?>

<?php if ($error): ?>

<p class="error"><?= e($error) ?></p>

<?php endif; ?>

<form method="post">

  <?= csrf_field() ?>

  <label for="password">Password</label>

  <input type="password" id="password" name="password" required autofocus autocomplete="<?= $firstRun ? 'new-password' : 'current-password' ?>">

<?php if ($firstRun): ?>

  <label for="confirm">Confirm password</label>

  <input type="password" id="confirm" name="confirm" required autocomplete="new-password">

<?php endif; ?>

  <div class="actions">

    <button><?= $firstRun ? 'Set password' : 'Login' ?></button>

  </div>

</form>

<?php if ($hasPasskeys): ?>

<script type="application/json" id="pkCfg"><?= json_encode(['csrf' => csrf_token()], JSON_HEX_TAG | JSON_HEX_AMP) ?></script>

<div class="actions">

  <button type="button" class="secondary" id="pkLogin">Sign in with a passkey</button>

</div>

<p class="muted" id="pkMsg"></p>

<?php endif; ?>

<?php

page_footer($hasPasskeys ? ['assets/passkey.js'] : []);